How to append search results multiple times based on change in particular field value

[sunilpanda023]

Hi,

I want to something like - append [Query-2] by clause

Situation is I have a result set from query-1 and query-2 as given in first table and second table respectively.
I want to append the result of query-2 multiple times based on logical change in project value at the end as given in expected output table. This is like - append [Query-2] by Project
Normal append result is provided in current output table.

Any help is appreciated.

.

[woodcock]

That was a fun one!

| makeresults 
| eval raw="Project_a,Sprint_1,5
Project_a,Sprint_2,10
Project_a,Sprint_3,4
Project_a,Sprint_4,3
Project_b,Sprint_1,20
Project_b,Sprint_2,3
Project_b,Sprint_3,5
Project_b,Sprint_4,4
Project_c,Sprint_1,4
Project_c,Sprint_2,8
Project_c,Sprint_3,4
Project_c,Sprint_4,5" 
| makemv delim="
" raw 
| mvexpand raw 
| rename raw AS _raw 
| rex "^(?<Project>[^,]+),(?<Sprint>[^,]+),(?<points>.*)$" 
| fields - _*

| rename COMMENT AS "Everything above should be replaced with your 'Query-1'"

| eval Sprint_and_points = Sprint . ":" . points
| stats list(Sprint_and_points) AS Sprint_and_points BY Project
| append 
    [| makeresults 
    | eval Sprint="Future_1 Future_2" 
    | makemv Sprint 
    | mvexpand Sprint 
    | fields - _*
    | rename COMMENT AS "Everything inside of this append should be replaced with your 'Query-2'"]
| eventstats list(Sprint) AS Sprints
| where isnull(Sprint)
| eval Sprint = mvappend(Sprint_and_points, Sprints)
| fields Project Sprint
| mvexpand Sprint
| rex field=Sprint "^(?<Sprint>[^:]+):(?<points>.*)$"

[HiroshiSatoh]

Try this!

search Query-1 
| append 
   [search Query-1
   |dedup Project
   |map search="search Query-2|eval Project=\"$Project$\"" 
   |fields Project,Sprint]
|sort Project